TI-2022-18582 Aliases CVE-2022-39202 GHSA-cq7q-5c67-w39w

IRC mode parameter confusion in matrix-appservice-irc

LOW 30CWE-269Published 2022-09-13 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00898 59th percentileScored 2026-11-07

Fix Fixed matrix-appservice-irc (matrix-org): 0.35.0matrix-appservice-irc (npm): 0.35.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	matrix-appservice-irc	before 0.35.0	0.35.0	Patch available	CNA
—	matrix-appservice-irc (npm)	before 0.35.0	0.35.0	Patch available	GHSA-cq7q-5c67-w39w

matrix-appservice-irc Vendormatrix-org Affected before 0.35.0 Fixed in 0.35.0 Patch available CNA
matrix-appservice-irc (npm) Vendor— Affected before 0.35.0 Fixed in 0.35.0 Patch available GHSA-cq7q-5c67-w39w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:matrix_irc_bridge::::::node.js::*	before 0.35.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* Versions before 0.35.0 Vulnerable ·matrix-org

Remediation

Fix · CNA matrix-appservice-irc (matrix-org) Fixed in 0.35.0
Fix · GHSA-cq7q-5c67-w39w matrix-appservice-irc (npm) Fixed in 0.35.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39202
2026-10-03 Alias added: GHSA-cq7q-5c67-w39w

References

Patch 1

https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67

Advisory 3

Other 2

TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
TI-2022-18583 Parsing issue in matrix-org/node-irc leading to room takeovers CVSS 3.1HIGH 8.8
TI-2022-11710 Improper handling of multiline messages in matrix-appservice-irc CVSS 3.1HIGH 8.8
TI-2022-03640 matrix-appservice-irc PgDataStore.ts sql injection CVSS 3.1MEDIUM 5.6
TI-2025-20003 Matrix IRC Bridge allows IRC command injection to own puppeted user CVSS 3.1MEDIUM 4.3
TI-2023-20048 matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences